CVE-2014-0644: Infoleak
EMC Cloud Tiering Appliance (CTA) 10 through SP1 allows remote attackers to read arbitrary files via an api/login request containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue, as demonstrated by reading the /etc/shadow file.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-0644?
CVE-2014-0644 has a medium severity rating due to the potential for unauthorized file access.
How do I fix CVE-2014-0644?
To mitigate CVE-2014-0644, upgrade the EMC Cloud Tiering Appliance to version 10.0 SP2 or later.
What impact does CVE-2014-0644 have on my system?
CVE-2014-0644 allows remote attackers to read sensitive files, which could lead to unauthorized data access.
Which versions of EMC Cloud Tiering Appliance are affected by CVE-2014-0644?
CVE-2014-0644 affects EMC Cloud Tiering Appliance versions 10.0 and 10.0 SP1.
Is there a workaround for CVE-2014-0644?
While upgrading is the best solution for CVE-2014-0644, disabling XML external entity processing may serve as a temporary workaround.